Splunk Search

Need to sort macOS versions

jbandautrgv
Engager

I imported data from jamf cloud into splunk and one of the fields being returned is the operating system version. It seems to be in a x.y.z format. I am removing the last two characters to get a count of the "major" versions to get a report by count. So far this works, but I'm trying to sort by the operating system version and the sorting doesn't seem to work. This is my search:

index="endpoint_apple" sourcetype="jamf:computers" | eval Operating_System_Version_Major = substr(Operating_System_Version, 1, len(Operating_System_Version)-2) | chart count(Operating_System_Version_Major) as count by Operating_System_Version_Major | sort -Operating_System_Version_Major

The data is being returned like this:

Operating_System_Version_Major count
10.9 2
10.8 1
10.7 3
10.15 6
10.14 362
10.13 321
10.12 259
10.11 73
10.10 5

I cannot figure out why 10.7 through 10.9 are being sorted higher than 10.15. I've tried "sort -num*Operating_System_Version_Major)" with no change, and I also have alternated between "chart" and "stats" to get the count. I've also attempted to remove the eval and just sort on Operating_System_Version with the same results. I'm not really sure what I'm missing, so if someone can point me in the right direction, I'd appreciate it.

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@jbandautrgv,

That's because version is a string and hence it sorts in lexicographical order

Try

index="endpoint_apple" sourcetype="jamf:computers" 
| eval Operating_System_Version_Major = substr(Operating_System_Version, 1, len(Operating_System_Version)-2) 
| chart count(Operating_System_Version_Major) as count by Operating_System_Version_Major 
| eval num=replace(version,"\.","")|sort num|fields - num
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@jbandautrgv,

That's because version is a string and hence it sorts in lexicographical order

Try

index="endpoint_apple" sourcetype="jamf:computers" 
| eval Operating_System_Version_Major = substr(Operating_System_Version, 1, len(Operating_System_Version)-2) 
| chart count(Operating_System_Version_Major) as count by Operating_System_Version_Major 
| eval num=replace(version,"\.","")|sort num|fields - num
---
What goes around comes around. If it helps, hit it with Karma 🙂

jbandautrgv
Engager

Thank you, I see what you did. I was hoping I could force splunk to treat "10.15" as a decimal and sort it like that, but what you suggested converting "10.15" to "1015" did work.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...